nx_proc_snapshot.nx

nx_proc_snapshot.nx -- ONE /proc walk answers EVERY liveness question (seq1318 root fix). THE DEFECT (measured 2026-07-30, source-grounded): nx_hostctl's proc_alive_by_name getdents-walks all of /proc and reads every /proc/<pid>/cmdline -- and it runs ONCE PER GUARDED SERVICE PER POLL. At ~25 guards x 951 processes that is ~23,775 cmdline reads per 15s poll (~1,585/s, ~4,750 syscalls/s) for LIVENESS ALONE, and it is a POSITIVE FEEDBACK LOOP: a fork storm inflates /proc, which inflates the scan, which inflates kernel time. Measured context-switch rate 81k-93k/s. THE FIX IS STRUCTURAL, NOT A TUNING KNOB: walk /proc ONCE, concatenate every cmdline into one blob, and answer all ~25 questions from memory with ZERO further syscalls. O(P) per poll, not O(S x P). A second, free property matters as much as the speed: every guard now reads the SAME INSTANT, so two guards can no longer disagree because they scanned at different times. THREE PROPERTIES MAKE IT SAFE BY CONSTRUCTION (not by caller discipline): 1. AGE-BOUNDED. ps_alive rebuilds when the snapshot is older than PS_MAX_AGE_MS. No call site has to remember to refresh; an answer can never be unboundedly stale even if a caller forgets. 2. INVALIDATED ON MUTATION. ps_invalidate() after any spawn/kill forecloses the one DANGEROUS staleness direction (snapshot says DEAD for a daemon that was just started -> a second spawn -> EADDRINUSE churn). Stale-says-ALIVE merely defers a restart one poll, which is benign. 3. FAIL-SAFE, NEVER FAIL-WRONG. Open failure or blob overflow returns PS_UNKNOWN, and the caller falls back to ps_alive_direct -- the exact pre-existing scan. Worst case is today's cost; a wrong answer is impossible. (A silent cap that answered "not alive" would kill live daemons.) ps_alive_direct is ALSO the gate's ORACLE: nx_proc_snapshot_gate proves snapshot == direct for every probed name, so the fast path is verified against the slow one rather than asserted. license_tier: ORIGINAL No hw writes (Rule 26). Importable (no main).